Atlas / MCP servers / trypeggy / Instagram DMs

Instagram DMsSAFE

Name: Instagram DMs
Author: trypeggy

mcp/trypeggy/instagram-dms

MCP server by trypeggy · ai · facebook · github · Audited 2026-10-06

⚑ Report / re-scan Source ↗

Instagram Direct messages MCP

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

25 19r · 5w · 1d

Transport

stdio

License

MIT

Stars

183

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

This is a Model Context Protocol (MCP) server for sending instagram Direct Messages.

With this you can send Instagram Direct Messages from your account (more capabilities coming soon).

Here's an example of what you can do when it's connected to Claude.

https://github.com/user-attachments/assets/9c945f25-4484-4223-8d6b-5bf31243464c

To get updates on this and other projects we work on enter your email here

Installation

Prerequisites

Python 3.11+
Anthropic Claude Desktop app (or Cursor)
Pip (Python package manager), install with python -m pip install
An instagram account

Steps

Clone this repository

git clone https://github.com/trypeggy/instagram_dm_mcp.git
cd instagram_dm_mcp

Install dependencies

Using uv (recommended):

uv sync

Using Pip:

pip install -r requirements.txt

Configure Instagram credentials

You have two options for providing your Instagram credentials:

Option A: Environment Variables (Recommended)

Quick Setup (Recommended):

Run the helper script:

python setup_env.py

This will interactively prompt you for your credentials and create the .env file securely.

Manual Setup:

Create a .env file in the project root:

cp env.example .env

Then edit .env with your actual credentials:

INSTAGRAM_USERNAME=your_instagram_username
INSTAGRAM_PASSWORD=your_instagram_password

Option B: Command Line Arguments

You can still pass credentials as command line arguments (less secure).

Connect to the MCP server

For Claude Desktop:

Save this as claude_desktop_config.json in your Claude Desktop configuration directory at:

~/Library/Application Support/Claude/claude_desktop_config.json

Read from source at commit db03d4b2946eOBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add instagram-dm-mcp --env INSTAGRAM_PASSWORD=${INSTAGRAM_PASSWORD} -- uvx instagram-dm-mcp

claude-desktop

{
  "mcpServers": {
    "instagram-dm-mcp": {
      "command": "uvx",
      "args": [
        "instagram-dm-mcp"
      ],
      "env": {
        "INSTAGRAM_PASSWORD": "${INSTAGRAM_PASSWORD}"
      }
    }
  }
}

Exposed tools (25)

19 read · 5 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`check_user_online_status`	read	Check the online status of Instagram users.
`delete_message`	destructive	Delete a message from a direct message thread.
`download_media_from_message`	read	Download media from a specific Instagram direct message and get the local file path.
`download_shared_post_from_message`	write	Download media from a shared post/reel/clip in a DM message and get the local file path.
`get_thread_by_participants`	read	Get an Instagram Direct Message thread by participant user IDs.
`get_thread_details`	read	Get details and messages for a specific Instagram Direct Message thread by thread ID, with an optional message limit.
`get_user_followers`	read	Get followers of an Instagram user.
`get_user_following`	read	Get users that an Instagram user is following.
`get_user_id_from_username`	read	Get the Instagram user ID for a given username.
`get_user_info`	read	Get detailed information about an Instagram user.
`get_user_posts`	read	Get recent posts from an Instagram user.
`get_user_stories`	read	Get Instagram stories from a user.
`get_username_from_user_id`	read	Get the Instagram username for a given user ID.
`like_media`	write	Like or unlike an Instagram post.
`list_chats`	read	Get Instagram Direct Message threads (chats) from the user
`list_media_messages`	read	List all messages containing media in an Instagram direct message thread.
`list_messages`	read	Get messages from a specific Instagram Direct Message thread by thread ID, with an optional limit.
`list_pending_chats`	read	Get Instagram Direct Message threads (chats) from the user
`mark_message_seen`	read	Mark a message as seen in a direct message thread.
`mute_conversation`	read	Mute or unmute a direct message conversation.
`search_threads`	read	Search Instagram Direct Message threads by username or keyword.
`search_users`	read	Search for Instagram users by name or username.
`send_message`	write	Send an Instagram direct message to a user by username.
`send_photo_message`	write	Send a photo via Instagram direct message to a user by username.
`send_video_message`	write	Send a video via Instagram direct message to a user by username.

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: none-observed
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (2)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_message

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

requirements.txt

Pillow

Why it matters. 1 requirement(s) not pinned with ==

Fix. pin exact versions

Gates applied: no_behavioural_pass.

Audited 2026-10-06 · audit v0.4.1 · source sha db03d4b2946efull audit observations/trust-audit/mcp-server/trypeggy__instagram-dms.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-06	`db03d4b2946e`	SAFE	B	89	first audit

Questions

What is the Instagram DMs MCP server?

Instagram Direct messages MCP

What tools does Instagram DMs expose?

25 in total: 19 read-only, 5 that write, and 1 that can delete or overwrite (delete_message). Every one is listed on this page with its risk.

Is Instagram DMs safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Instagram DMs need?

It reads INSTAGRAM_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Instagram DMs run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as instagram-dm-mcp.

How current is this page?

The grade is for one exact copy of the source (db03d4b2946e), read on 2026-10-06. The repository is watched and re-audited when it changes.

Source	trypeggy/instagram_dm_mcp
PyPI	`instagram-dm-mcp`
Transports	stdio
Credentials it reads	`INSTAGRAM_PASSWORD`
License	MIT
Activity	pushed 419d ago